{"id":63911,"date":"2022-08-02T09:00:00","date_gmt":"2022-08-02T08:00:00","guid":{"rendered":""},"modified":"2022-08-01T10:18:35","modified_gmt":"2022-08-01T09:18:35","slug":"how-fsi-organisations-should-balance-supply-chain-and-concentration-risk","status":"publish","type":"post","link":"https:\/\/newed.any0.dpdns.org\/en-gb\/industry\/blog\/financial-services\/2022\/08\/02\/how-fsi-organisations-should-balance-supply-chain-and-concentration-risk\/","title":{"rendered":"How FSI organisations should balance supply chain and concentration risk"},"content":{"rendered":"

\"ManI speak to a lot of people about the security challenges facing financial services organisations in my role as Cyber Security Sales Director at Microsoft. The topics of those conversations change as the threat landscape evolves and new approaches to managing those threats emerge.<\/p>\n

But a topic that seems to be top of mind in every meeting I\u2019m in at the moment is supply chain risk. In particular, how we can balance it against the risks that come from concentration.<\/p>\n

So, what do we mean by concentration risk? And where should organisations stand on the axis between that and the risks that come with multiple-vendor supply chains?<\/p>\n

In this article, I want to unpack the debate with particular regard to FSI organisations, and offer some ideas for how CISOs can move forward securely and with confidence.<\/p>\n

The risks of a multiple-vendor approach to security<\/h3>\n

Many of the customers I speak to face a dilemma: stitch together multiple security vendors from the top right of the Gartner Magic Quadrant<\/a>, or go with a best-of-suite approach with a smaller number of vendors?<\/p>\n

Both approaches have their benefits and drawbacks. Historically, the Magic Quadrant approach has been the most prevalent, because customers have felt that buying all the best-in-class products and services will give them the best level of security.<\/p>\n

It\u2019s an approach that’s been followed by lots of CISOs for years also because it\u2019s been easy to justify to the board. But it\u2019s one that comes with a number of risks.<\/p>\n

Integrating multiple security vendors has always been a challenge for organisations. It’s complex and costly, and it can be difficult to keep the skills within the organisations to maintain it. But while these challenges have been known to organisations for some time, what’s become apparent more recently is the security risk a supply chain poses to an organisation.<\/p>\n

Put simply, the more vendors you have in your environment, the higher your risk. This really came to light following the SolarWinds incident<\/a>. One of SolarWinds\u2019 products was compromised and it had an impact on a large number of SolarWinds\u2019 partners. The hackers used the vulnerability in the SolarWinds software as a way to gain access to their customers environments.<\/p>\n

And these types of attacks are growing. In fact, 45 percent of organisations worldwide will have experienced attacks on their software supply chains by the end of 2025, according to Gartner<\/a>, a three-fold increase from 2021.<\/p>\n

It\u2019s something organisations are acutely aware of and was the focus of the City of London Innovation Challenge, which I presented at a few weeks ago. The event brought together FSI organisations such as Nationwide and Hiscox alongside tech companies to try and tackle the challenge of supply chain risk.<\/p>\n

Managing supply chain risk<\/h3>\n

Companies try to stay on top of their supply chain risk by thoroughly auditing their suppliers. The challenge with this is that the answers the organisation gets back are only as good as the questions they ask. What\u2019s more, the data from those audits quickly becomes out-of-date, because an audit isn\u2019t a continuous process.<\/p>\n

Some of the questions that organisations need to ask are:<\/p>\n